New Delhi – The Ministry of Electronics and Information Technology (MeitY) has served formal notices to the messaging platforms Telegram and Signal, demanding detailed explanations of how their username systems address fraud, impersonation and scams. The notices, issued on Thursday, give the companies three days to respond. The move follows a similar directive earlier this month that required Meta’s WhatsApp to modify its user‑identification practices, signalling a broader regulatory push on encrypted messaging services in India.
What happened
MeitY’s notices request that Telegram and Signal provide “comprehensive documentation” on the technical and policy safeguards built into their username features. In Telegram’s case, officials singled out the app’s public “username” handle, which allows users to be found and contacted without sharing phone numbers. The government asked Telegram to explain why it continues to offer this feature and how it prevents misuse such as fraud, impersonation and cyber‑crime.
Signal’s notice focuses on its own username mechanism, which similarly enables users to share a public identifier. The ministry asked the company to detail any anti‑scam measures, verification processes and monitoring tools it employs. Both notices set a three‑day deadline for a written response, after which MeitY may consider further action under India’s Digital Communications Policy and related regulations.
Why it matters
The notices arrive at a time when Indian authorities are tightening oversight of digital communications, especially encrypted platforms that have grown in popularity after the 2020 WhatsApp ban on bulk messaging. By targeting the username systems—features that make it easier to discover and contact users without phone numbers—the government is addressing a perceived loophole that could facilitate large‑scale fraud, phishing and the spread of misinformation.
If the platforms fail to satisfy the ministry’s queries, they could face penalties ranging from fines to restrictions on service availability in India. Such outcomes would have significant implications for user privacy, as both Telegram and Signal are marketed on end‑to‑end encryption and minimal data collection. A crackdown could also set a precedent for further regulatory demands on other global tech firms operating in the country.
Background and context
India’s push to regulate messaging apps intensified after the Supreme Court’s 2020 decision that upheld the government’s ban on WhatsApp’s “unlimited forwarding” feature, citing concerns over the spread of fake news during elections. In March 2024, MeitY issued a notice to Meta demanding changes to WhatsApp’s user‑identification policies, including the removal of “publicly visible” usernames that could be used for impersonation. Meta complied by disabling the feature for Indian users.
The current notices extend that regulatory focus to other encrypted services. Telegram, owned by Russian entrepreneur Pavel Durov, has a user base of over 50 million in India, according to its own figures. Signal, developed by the non‑profit Signal Foundation, is widely used by journalists, activists and privacy‑concerned citizens. Both apps have resisted extensive data‑sharing with governments, citing encryption and a commitment to user anonymity.
India’s Digital Communications Policy, last revised in 2022, mandates that “service providers must implement reasonable measures to prevent the misuse of their platforms for fraudulent or criminal activities.” The policy also empowers MeitY to issue notices and enforce compliance within a short timeframe, a provision the ministry is now invoking.
Competing claims and uncertainty
Telegram and Signal have not yet responded to the notices, and their official statements remain pending. In past interactions with Indian regulators, both companies have emphasized that their username features are optional and that they rely on user‑reported abuse to take action. Telegram’s public blog, for example, notes that usernames can be changed or deleted by the account holder and that the platform employs automated detection of spam and phishing links.
Signal’s documentation states that usernames are “a convenience feature” and that the app does not store any metadata linking a username to a phone number or IP address. However, the company has previously resisted government requests for user data, arguing that its encryption architecture prevents decryption even under legal compulsion.
Critics argue that demanding detailed technical disclosures could undermine the security architecture of end‑to‑end encryption. “If regulators require back‑door access or detailed logs of username creation, it could erode the privacy guarantees that make these apps attractive,” said Anjali Mehta, a digital‑rights researcher at the Centre for Internet and Society.
Conversely, law‑enforcement officials maintain that “publicly visible identifiers can be weaponised by fraudsters, especially in a market as large as India where digital transactions are booming.” A senior officer in the Cyber Crime Division, speaking on condition of anonymity, said that the ministry’s focus on usernames is “a logical next step after addressing bulk forwarding and deep‑fake content.”
The legal basis for the three‑day deadline also raises questions. While the Digital Communications Policy allows for “prompt” responses, the exact definition of “prompt” is not codified, leaving room for interpretation and potential disputes over procedural fairness.
What to watch next
The three‑day response window closes on Monday, August 5. If Telegram and Signal submit satisfactory explanations, MeitY may issue a compliance order that could require changes to the username features, such as mandatory verification, limited visibility, or the introduction of a reporting mechanism for abuse.
Should the companies fail to respond or provide inadequate information, the ministry could invoke the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which empower it to levy fines up to ₹5 crore (≈ $600,000) per day of non‑compliance. In extreme cases, the government could direct app stores to remove the services from the Indian market, a step it took against several VPN providers in 2023.
Industry observers will also watch for any parallel actions against other messaging apps, such as Viber or regional platforms like Hike, which have not yet been targeted but could face similar scrutiny.
Conclusion
The notices to Telegram and Signal underscore India’s escalating regulatory scrutiny of encrypted messaging services, particularly features that enable public discoverability. While the government frames the move as a necessary step to curb fraud and impersonation, the demands raise complex questions about privacy, encryption integrity and the balance between security and user rights. The forthcoming responses from the two platforms will reveal how much leeway global tech firms have in adapting to India’s increasingly assertive digital policy framework.
Sources
Times of India, “After WhatsApp, Centre sends notices to Telegram, Signal,” https://timesofindia.indiatimes.com/india/after-whatsapp-centre-sends-notices-to-telegram-signal/articleshow/132147700.cms
Story synopsis gathered from: Times of India – Top Stories — source
Corrections
If you believe this article contains an error, contact Herald Express with the source URL and supporting evidence.
